In case there is a logical problem on the primary (wrong data processing, misleaded application upgrade,…) we want to perform a manual failover to the standby, which still contains the old, correct data status.
That means the standby should __not__ apply any more WALs within the 3 hour residue in the event of a manual failover.
When I tried a "patronictl failover" the standby first applied all outstanding WALs (which I don't want) and only then promoted the standby.